Re: [whatwg/dom] Draft integration with Trusted Types, take 2. (PR #1247)

@lukewarlow commented on this pull request.



> - <a for=Attr>local name</a> is <var>localName</var>, <a for=Attr>value</a> is <var>value</var>, and
- <a for=Node>node document</a> is <var>element</var>'s <a for=Node>node document</a>, then
- <a lt="append an attribute">append</a> this <a>attribute</a> to <var>element</var>, and then
- return.
+ <li>
+  <p>If <var>attribute</var> is null, then:
+  <ol>
+    <li><p>Set <var>attribute</var> to a new <a>attribute</a> whose <a for=Attr>namespace</a> is
+    <var>namespace</var>, <a for=Attr>namespace prefix</a> is <var>prefix</var>,
+    <a for=Attr>local name</a> is <var>localName</var> and <a for=Node>node document</a> is
+    <var>element</var>'s <a for=Node>node document</a>.
+
+    <li><p><a>Validate and set attribute value</a> <var>value</var> for <var>attribute</var> with
+    <var>element</var>.
+
+    <li><p><a lt="append an attribute">Append</a> <var>attribute</var> to <var>element</var>.

Having tested this in Chrome it results in some rather weird behaviour (the DOM apis for getting the attribute return the value of the attribute set inside the TT validation steps (from default policy in this case). But the HTML markup in dev tools AND the actual action that occurs is the one set via the original call to setAttribute.

I'm thinking we could check after the validate call if the attribute exists, and if it does we can either throw or skip out to the process that happens when the attribute already exists?

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/dom/pull/1247#discussion_r1559545355
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/dom/pull/1247/review/1991855756@github.com>